MediumII Cyber Warfare & Critical Infrastructure13 October 2026, Tuesday
Cyber attack on refrigeration hits 700 French supermarkets
French Finance Minister Lescure told parliament on 13 October that 700 of the country's roughly 10,000 supermarkets had been hit by a cyber attack on their refrigeration systems. By 13 October the attack had also reached chains in the Netherlands, Belgium and the US.
According to an AP report on News4Jax, France's cyber-security agency ANSSI found numerous compromises of remote-control modules made by Denmark's Danfoss and America's Copeland. Danfoss said on 13 October that most affected systems were older products no longer receiving updates. Copeland said the same day that the flaw lay in a discontinued generation of controllers. In August the security firm Claroty had reported vulnerabilities in the Danfoss AK-SM 800A and Copeland XWeb Pro, along with large numbers of controllers exposed directly to the internet.
Some 300 Intermarché and Netto stores in the Les Mousquetaires group were affected, as were 80 of Coopérative U's 2,000 stores. Ahold Delhaize said it was working to restore systems it had shut down after a security issue; Albert Heijn, Delhaize, Stop & Shop and Food Lion stores stayed open, but their websites were down on 13 October. PJ Media reports that freezer temperatures were pushed above 49 degrees and product losses reached $11.2 million.
The Paris prosecutor's cybercrime unit opened an investigation on 13 October. No ransom demand or data theft has been reported, and as of 13 October no one had claimed the attack. Lescure said on 13 October there was no risk to food supply, but that the attack had struck at the heart of food security.
Talay assessment
Bottom line
What is new is the scale and the target: a campaign that seeks no ransom and steals no data, producing only physical damage, has spread to four countries. The common thread is end-of-life controllers from two manufacturers left exposed to the internet. That points to a problem in Europe's installed base of commercial refrigeration, not in a single chain; similar waves may follow.
Likely effects
- Retail and foodNegativeWeeks
Product losses of $11.2 million and shut-down systems squeeze chains' margins and stock management in the near term; replacing old controllers requires investment.
- Critical-infrastructure regulationUncertain1–6 months
The food cold chain becoming a cyber target could speed up the EU debate on cyber oversight of the food sector and manufacturer liability.
- Turkish retailNegativeWeeks
For Turkish chains using the same makers' controllers, scanning for internet-exposed devices and segmenting networks is an urgent check.
Possibilities, ranked
- 1Campaign spreads to new countries50%
Internet-exposed legacy controllers cannot be shut off quickly, and the attack appears in other EU countries.
Watch: New compromise notices from ANSSI and other national CERTs
- 2Contained by fast disconnection35%
Devices are taken off networks and the number of affected stores stays around 700.
Watch: Ahold Delhaize websites coming back online and company statements
- 3Attributed to a state-linked actor15%
The investigation ties the attack to a state-backed group, moving it onto the hybrid-threat agenda.
Watch: A Paris prosecutor's statement on the investigation
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- French stores affected▼ 700
- Product losses▼ $11.2m